17 ms·

IRS claims it can read your e-mail without a warrant

198 points by DanielBMarkham 14y ago

driverdan 14y ago
Original article: http://www.aclu.org/blog/technology-and-liberty-national-security/new-documents-suggest-irs-reads-emails-without-warrant http://www.aclu.org/blog/technology-and-liberty-national-sec...
rayiner 14y ago
This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those states and nowhere else. Other circuits might find this precedent persuasive and agree in future cases, and that is something the IRS will have to deal with in future prosecutions, but for a Handbook on the law as it stands now, this statement is absolutely accurate. The nation-wide precedent is they can access anything older than 180 days without a warrant, which for IRS's purposes is basically anything that would be relevant to a criminal tax prosecution (there is no statute of limitations on willful tax evasion or fraud). Should we have privacy rights in our e-mails and personal messages? I think so. But the Constitution doesn't protect that, any more than it protects "one's papers" if those papers are left on the premises of a third party.[1] Not everything that is a good idea must be necessitated by the Constitution. [1] Wikipedia's article on "expectation of privacy" is pretty good: http://en.wikipedia.org/wiki/Expectation_of_privacy http://en.wikipedia.org/wiki/Expectation_of_privacy ("In general, one cannot have a reasonable expectation of privacy in things held out to the public."). If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary.
- mtgx 14y ago
  Can they access mail without a warrant that is older than 180 days? If not how the hell is that e-mail law constitutional?
  - rayiner 14y ago
    The EFF has a good page on the principles underlying "reasonable expectation of privacy." See: https://ssd.eff.org/your-computer/govt/privacy https://ssd.eff.org/your-computer/govt/privacy. The crux of the matter is "knowing exposure to third parties." So you have an expectation of privacy in sealed postal mail, but not say post cards or anything printed on the outside of envelopes. While a postal service as a matter of course can't read what's in peoples' sealed letter mail, e-mail is sent in plain text and can be seen by any intermediary SMTP server as well as system administrators of the sending and target mail servers. That's just the nature of the protocol. Moreover, the fact that the U.S. Postal Service is an agency of the government puts it under heightened scrutiny as compared to e-mail providers who are private parties. The fact that people would be horrified if the U.S. Postal Service were tearing open envelopes and scanning mail to send targeted catalogs, etc, to people but accept Google, etc, doing the same thing as a matter of course really cuts at the knees of the argument that people have the same "expectation of privacy" in their e-mail as they do their letter mail.
    - DanielBMarkham 14y ago
      But now that gmail has ssl access, this is no longer true, right?
      - rayiner 14y ago
        Gmail has SSL to Google's e-mail server. If you e.g. send a mail to someone using Outlook, it's sent in clear text. And at both ends it's scanned to deliver everyone involved targeted advertising. "Reasonable expectation of privacy" doesn't have an implicit "only as against the government." If you're knowingly exposing the contents to Google and Microsoft to scan, you can't claim to have a "reasonable expectation of privacy" in the contents.
JVIDEL 14y ago
Nothing is certain but death, parsing errors and taxes
- jason_slack 14y ago
  Parsing errors +10. Thanks for the chuckle.
  - gknoy 14y ago
    Why would death be parsing errors and taxes? ;)
nraynaud 14y ago
Look, wouldn't it be simpler to make the list of organizations who can't read emails in the USA?
- socillion 14y ago
  [] There's your list.
Jach 14y ago
When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"? Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.
- trent_91 14y ago
  It's not that long since PGP was considered weapons-grade munitions and could not be exported. We may yet return to that stage.
  - lutze 14y ago
    It wouldn't surprise me if various enforcement agencies viewed encryption as sufficiently suspicious behaviour to arrest/investigate you for some kind of "terrorism" charge anyway.
- sp332 14y ago
  If you want to send someone a message, you have to use their public key. If a message is encrypted with your public key, it can only be decrypted by your own private key. Edit: ok your edit makes more sense now :)
  - __david__ 14y ago
    Yes, he meant if he gives his email out to a website (amazon.com, say) he wants to give them his PGP public key as well so that all correspondence to him will be encrypted through PGP. I would like this, too. Internet, please get on that.
- __david__ 14y ago
  It'll happen only when PGP isn't just used by .001% [1] of email users. It needs some really good integration with an email client somewhere, where addresses are picked up from a public key server and automatically encrypted. I'm picturing an iMessage style thing where as you're typing someones email address, the keyserver is getting pinged and the address turns a different color and a lock icon appears by it. Now all your correspondence with that person is encrypted. PGP purists might not like it ("but you're automatically trusting some random key!! The web of trust, the web of trust!") but it would be a step in the right direction. [1] Statistic I just made up.
unreal37 14y ago
Is there any evidence that the IRS has ever been able to get access to people's emails without a warrant, or is this entire discussion theoretical? It seems to just be quoting a 2009 handbook recently obtained. Google won't give your email away without a warrant, and neither will Facebook. So I'm not sure what this means.
- declan 14y ago
  But Google and Facebook are not the only two companies that store users' electronic messages (it's not just email, remember, but also direct messages, stored IM chats, etc.)...
  - overdrivetg 14y ago
    Also don't forget about Carnivore/Echelon and their ilk that presumably have the ability to intercept and store basically all email. Then once your email is duplicated in a government database somewhere, it being primarily housed on a Google or FB server is irrelevant.
    - rayiner 14y ago
      It's not irrelevant. The 4th amendment is enforced primarily by the exclusionary rule. The fact that Carnivore, Echelon, etc, can get to your e-mail anyway doesn't mean that the government can introduce it as evidence in court. To the extent that the 4th amendment doesn't extend to the stuff you store on Google's, Facebook's, etc, servers, the government can introduce that as evidence against you.
      - logn 14y ago
        But it does mean they could use your email contents to decide to audit you, then in the course of the audit find information which is permissible in court. I'd be shocked if given the revelation in this article, the IRS doesn't browse the email of some people before auditing them.
doki_pen 14y ago
It's funny how in one breath the government tells us that there is no reasonable expectation of privacy for data on the internet and in another the DMCA says that the act of knowingly breaking any security, no matter how weak, is a serious crime.
- unreal37 14y ago
  And in fact securing something can be interpreted by some as intent to deceive. Only terrorists use PGP and really serious encryption. "if you don't have anything to hide, you have nothing to fear" -- Eric Schmidt of Google
- logn 14y ago
  And in the other breath say making a GET request to AT&T following some obvious pattern of IDs makes you a cyber criminal.
forgotAgain 14y ago
Its time Americans realized that their government does whatever the hell it pleases. There are too many secret courts and black op intelligence agencies operating within US borders for a rational citizen to reach any other conclusion. If the government wants to read your email, it will. If it refrains from reading your email it's only because it doesn't find you interesting enough to go through the hassle of doing so.
johngalt 14y ago
The problem with email privacy: it's trivial to copy/forward email, but hard to ensure every endpoint is secure. Even if you are running your own MX in your basement, all of your email recipients use Gmail.
- rsync 14y ago
  Your communication to users on the same server, however, is secure since it isn't actually email - it is just a local copy operation. Every single rsync.net intra-company "email" has never crossed a wire - always just a local copy operation. Yes, we do all use (al)pine over SSH, so no, it didn't cross a wire to a web browser.
craftkiller 14y ago
Why don't people listen when we tell them to encrypt everything?
mikeocool 14y ago
This article would be much more concerning if it was titled 'Google claims the IRS can read your email without a warrant.' The IRS can think whatever it pleases about accessing your email, however it still needs your provider to cooperate and turn over your email without a warrant. Google's stance on this particular issue is actually quite the opposite of the IRS's: http://www.wired.com/threatlevel/2013/01/google-says-get-a-warrant/ http://www.wired.com/threatlevel/2013/01/google-says-get-a-w...
comex 14y ago
This thread is full of hackers eager to apply a technological solution - encryption - to a problem which is better solved legally. Encryption has rather obvious usability problems, such as being fundamentally incompatible with webmail (and remote access in general - even if you use a client that decrypts emails, you can't search without downloading your entire inbox); while it's highly valuable for myriad use cases, I shouldn't have to use it for all my random mail. Yes, email seems fundamentally insecure technically, SMTP servers bouncing messages to other SMTP servers in the clear, but older networks such as physical mail and telephone are even worse and harder to secure, yet I still have an expectation of privacy (even if I use a PO box to store my mail remotely...) because it has been established by law. There is zero reason this shouldn't apply to email.

198 points by DanielBMarkham 14y ago

Original article: http://www.aclu.org/blog/technology-and-liberty-national-security/new-documents-suggest-irs-reads-emails-without-warrant http://www.aclu.org/blog/technology-and-liberty-national-sec...

rayiner 14y ago

This statement: "Newly disclosed documents prepared by IRS lawyers says that Americans enjoy 'generally no privacy' in their e-mail, Facebook chats, Twitter direct messages, and similar online communications" is entirely consistent with the existence of Warshack. Warshack covers the Sixth Circuit, which includes the following states: Kentucky, Michigan, Ohio, and Tennessee. The IRS is bound by this precedent in those states and nowhere else. Other circuits might find this precedent persuasive and agree in future cases, and that is something the IRS will have to deal with in future prosecutions, but for a Handbook on the law as it stands now, this statement is absolutely accurate. The nation-wide precedent is they can access anything older than 180 days without a warrant, which for IRS's purposes is basically anything that would be relevant to a criminal tax prosecution (there is no statute of limitations on willful tax evasion or fraud). Should we have privacy rights in our e-mails and personal messages? I think so. But the Constitution doesn't protect that, any more than it protects "one's papers" if those papers are left on the premises of a third party.[1] Not everything that is a good idea must be necessitated by the Constitution. [1] Wikipedia's article on "expectation of privacy" is pretty good: http://en.wikipedia.org/wiki/Expectation_of_privacy http://en.wikipedia.org/wiki/Expectation_of_privacy ("In general, one cannot have a reasonable expectation of privacy in things held out to the public."). If you understand how SMTP works, it's hard to argue that it's a private means of communication. You send a clear-text message to a publically-accessible service that is empowered to forward the message to other publically-accessible servers if necessary.

mtgx 14y ago
Can they access mail without a warrant that is older than 180 days? If not how the hell is that e-mail law constitutional?
- rayiner 14y ago
  The EFF has a good page on the principles underlying "reasonable expectation of privacy." See: https://ssd.eff.org/your-computer/govt/privacy https://ssd.eff.org/your-computer/govt/privacy. The crux of the matter is "knowing exposure to third parties." So you have an expectation of privacy in sealed postal mail, but not say post cards or anything printed on the outside of envelopes. While a postal service as a matter of course can't read what's in peoples' sealed letter mail, e-mail is sent in plain text and can be seen by any intermediary SMTP server as well as system administrators of the sending and target mail servers. That's just the nature of the protocol. Moreover, the fact that the U.S. Postal Service is an agency of the government puts it under heightened scrutiny as compared to e-mail providers who are private parties. The fact that people would be horrified if the U.S. Postal Service were tearing open envelopes and scanning mail to send targeted catalogs, etc, to people but accept Google, etc, doing the same thing as a matter of course really cuts at the knees of the argument that people have the same "expectation of privacy" in their e-mail as they do their letter mail.
  - DanielBMarkham 14y ago
    But now that gmail has ssl access, this is no longer true, right?
    - rayiner 14y ago
      Gmail has SSL to Google's e-mail server. If you e.g. send a mail to someone using Outlook, it's sent in clear text. And at both ends it's scanned to deliver everyone involved targeted advertising. "Reasonable expectation of privacy" doesn't have an implicit "only as against the government." If you're knowingly exposing the contents to Google and Microsoft to scan, you can't claim to have a "reasonable expectation of privacy" in the contents.

JVIDEL 14y ago

Nothing is certain but death, parsing errors and taxes

jason_slack 14y ago
Parsing errors +10. Thanks for the chuckle.
- gknoy 14y ago
  Why would death be parsing errors and taxes? ;)

nraynaud 14y ago

Look, wouldn't it be simpler to make the list of organizations who can't read emails in the USA?

socillion 14y ago
[] There's your list.

Jach 14y ago

When will "does not give the option to encrypt all outgoing correspondence with my PGP public key" become as embarrassing for an important website as "doesn't have an SSL cert" or "emails/stores passwords in plaintext"? Edit: added word "outgoing" for pedant below. ;) Of course it'd be nice to get their public key too if you had to correspond back without going through say their https website.

trent_91 14y ago
It's not that long since PGP was considered weapons-grade munitions and could not be exported. We may yet return to that stage.
- lutze 14y ago
  It wouldn't surprise me if various enforcement agencies viewed encryption as sufficiently suspicious behaviour to arrest/investigate you for some kind of "terrorism" charge anyway.
sp332 14y ago
If you want to send someone a message, you have to use their public key. If a message is encrypted with your public key, it can only be decrypted by your own private key. Edit: ok your edit makes more sense now :)
- __david__ 14y ago
  Yes, he meant if he gives his email out to a website (amazon.com, say) he wants to give them his PGP public key as well so that all correspondence to him will be encrypted through PGP. I would like this, too. Internet, please get on that.
__david__ 14y ago
It'll happen only when PGP isn't just used by .001% [1] of email users. It needs some really good integration with an email client somewhere, where addresses are picked up from a public key server and automatically encrypted. I'm picturing an iMessage style thing where as you're typing someones email address, the keyserver is getting pinged and the address turns a different color and a lock icon appears by it. Now all your correspondence with that person is encrypted. PGP purists might not like it ("but you're automatically trusting some random key!! The web of trust, the web of trust!") but it would be a step in the right direction. [1] Statistic I just made up.

unreal37 14y ago

Is there any evidence that the IRS has ever been able to get access to people's emails without a warrant, or is this entire discussion theoretical? It seems to just be quoting a 2009 handbook recently obtained. Google won't give your email away without a warrant, and neither will Facebook. So I'm not sure what this means.

declan 14y ago
But Google and Facebook are not the only two companies that store users' electronic messages (it's not just email, remember, but also direct messages, stored IM chats, etc.)...
- overdrivetg 14y ago
  Also don't forget about Carnivore/Echelon and their ilk that presumably have the ability to intercept and store basically all email. Then once your email is duplicated in a government database somewhere, it being primarily housed on a Google or FB server is irrelevant.
  - rayiner 14y ago
    It's not irrelevant. The 4th amendment is enforced primarily by the exclusionary rule. The fact that Carnivore, Echelon, etc, can get to your e-mail anyway doesn't mean that the government can introduce it as evidence in court. To the extent that the 4th amendment doesn't extend to the stuff you store on Google's, Facebook's, etc, servers, the government can introduce that as evidence against you.
    - logn 14y ago
      But it does mean they could use your email contents to decide to audit you, then in the course of the audit find information which is permissible in court. I'd be shocked if given the revelation in this article, the IRS doesn't browse the email of some people before auditing them.

doki_pen 14y ago

It's funny how in one breath the government tells us that there is no reasonable expectation of privacy for data on the internet and in another the DMCA says that the act of knowingly breaking any security, no matter how weak, is a serious crime.

unreal37 14y ago
And in fact securing something can be interpreted by some as intent to deceive. Only terrorists use PGP and really serious encryption. "if you don't have anything to hide, you have nothing to fear" -- Eric Schmidt of Google
logn 14y ago
And in the other breath say making a GET request to AT&T following some obvious pattern of IDs makes you a cyber criminal.

forgotAgain 14y ago

Its time Americans realized that their government does whatever the hell it pleases. There are too many secret courts and black op intelligence agencies operating within US borders for a rational citizen to reach any other conclusion. If the government wants to read your email, it will. If it refrains from reading your email it's only because it doesn't find you interesting enough to go through the hassle of doing so.

johngalt 14y ago

The problem with email privacy: it's trivial to copy/forward email, but hard to ensure every endpoint is secure. Even if you are running your own MX in your basement, all of your email recipients use Gmail.

rsync 14y ago
Your communication to users on the same server, however, is secure since it isn't actually email - it is just a local copy operation. Every single rsync.net intra-company "email" has never crossed a wire - always just a local copy operation. Yes, we do all use (al)pine over SSH, so no, it didn't cross a wire to a web browser.

craftkiller 14y ago

Why don't people listen when we tell them to encrypt everything?

mikeocool 14y ago

This article would be much more concerning if it was titled 'Google claims the IRS can read your email without a warrant.' The IRS can think whatever it pleases about accessing your email, however it still needs your provider to cooperate and turn over your email without a warrant. Google's stance on this particular issue is actually quite the opposite of the IRS's: http://www.wired.com/threatlevel/2013/01/google-says-get-a-warrant/ http://www.wired.com/threatlevel/2013/01/google-says-get-a-w...

comex 14y ago

This thread is full of hackers eager to apply a technological solution - encryption - to a problem which is better solved legally. Encryption has rather obvious usability problems, such as being fundamentally incompatible with webmail (and remote access in general - even if you use a client that decrypts emails, you can't search without downloading your entire inbox); while it's highly valuable for myriad use cases, I shouldn't have to use it for all my random mail. Yes, email seems fundamentally insecure technically, SMTP servers bouncing messages to other SMTP servers in the clear, but older networks such as physical mail and telephone are even worse and harder to secure, yet I still have an expectation of privacy (even if I use a PO box to store my mail remotely...) because it has been established by law. There is zero reason this shouldn't apply to email.